Unauthenticated Denial of Service in Milvus by Milvus-IO
CVE-2026-69111

8.7HIGH

Key Information:

Vendor

Milvus-io

Status
Milvus
Vendor
CVE Published:
5 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-69111?

The vulnerability in Milvus allows remote attackers to exploit the unprotected /management/stop endpoint, leading to a denial of service. By sending a crafted HTTP GET request to the management server on port 9091, attackers can terminate service components such as the proxy, datanode, or querynode. This occurs due to a bypass of REST API authentication middleware when a 'role' parameter is supplied, enabling attackers to disrupt services without prior authentication.

Affected Version(s)

milvus 0 <= 2.6.22

milvus 0 <= 2.6.22

milvus 3.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-69111 - Proof of Concept

References

https://github.com/milvus-io/milvus/issues/50763
technical-descriptionexploit
https://github.com/milvus-io/milvus/pull/49847
issue-tracking
https://github.com/milvus-io/milvus/pull/51573
issue-tracking

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.